Privacy notice.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Company

Avalon Aircraft UG (haftungsbeschränkt)

Address

Kolonnenstraße 8, 10827 Berlin, Germany

Managing director

Kristian Stockhaus

Email

datenschutz@avalonaircraft.com

2. Scope of this website

This website is a purely static information site. There are no user accounts, no registration, no contact forms, no comment function and no login. We collect no data that you enter yourself, because there are no input fields.

3. Server log files and hosting

The website is hosted on Cloudflare Pages. When you access it, technically necessary connection data is processed:

• IP address of the requesting device
• date and time of access
• file requested and volume of data transferred
• browser type and operating system transmitted (user agent)
• referrer URL, where sent by the browser

The legal basis is Art. 6 (1)(f) GDPR. The legitimate interest lies in the secure and stable operation of the website and in defending against attacks. This data is not combined with other sources and is not evaluated for advertising purposes.

4. Processors

Data processing agreements under Art. 28 GDPR are in place with every service provider used.

Cloudflare, Inc. (USA)

Hosting of the static website, DNS, content delivery network, TLS termination and protection against bot and DDoS attacks. Delivery is primarily from EU data centres. Transfers to third countries rely on the EU Standard Contractual Clauses; Cloudflare is certified under the EU-US Data Privacy Framework.

Google Ireland Ltd. (Ireland)

Provision of email services (Google Workspace) for messages you send to our business addresses. Processing takes place within the European Union.

5. Cookies and storage on your device

This website sets no cookies of its own and writes nothing to local storage or session storage. No tracking, analytics or marketing cookies are used.

Cloudflare may set a technically necessary cookie ("__cf_bm", lifetime 30 minutes) to distinguish human visitors from automated requests. This storage is strictly necessary to provide the service and therefore requires no consent under §25 (2) no. 2 TDDDG (formerly TTDSG); the subsequent processing relies on Art. 6 (1)(f) GDPR.

6. No analytics or tracking tools

We use no web analytics, no Google Analytics, no tracking pixels, no social media plugins and no advertising networks. No profiling and no automated decision-making takes place.

7. Fonts and external content

The website uses only system fonts already present on your device. No fonts are loaded from Google Fonts or any other third party. No external scripts, iframes, maps or video players are embedded; all images are served from our own domain.

8. Contacting us by email

If you write to us using one of the email links on this website, we process the details you provide (name, email address, content of your message) in order to handle your enquiry. The legal basis is Art. 6 (1)(b) GDPR for contract-related enquiries and otherwise Art. 6 (1)(f) GDPR.

Your message is deleted once it is no longer required for that purpose and no commercial or tax retention obligations apply.

9. Retention periods

Connection data from security events is pseudonymised or deleted after 90 days, unless there is a specific suspicion of abuse. Business correspondence is subject to statutory commercial and tax retention periods.

10. Your rights

Under the GDPR you have the following rights:

• access to the data processed about you (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure, unless retention obligations apply (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• objection to processing based on legitimate interests (Art. 21)

Please address requests to datenschutz@avalonaircraft.com. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin.

11. Data security

All transmission is TLS-encrypted (HTTPS). In addition we apply a restrictive Content Security Policy, HTTP Strict Transport Security and further security headers to make tampering with the delivered content harder.

12. Changes to this notice

We update this privacy notice when the legal or technical circumstances change. The current version is always available on this page.